I have the following audit message

Raw Audit Messages
type=AVC msg=audit(1687022594.74:347): avc:  denied  { mmap_zero } for  pid=3953 comm="check" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=memprotect permissive=0

This warning gets triggered from time to time around system startup, and I cannot find the process involved. The name check is too generic to use the locate command and the process is no longer running by the time I would have the chance to peek at the PID.

Thanks.